Chris Gill

n00b | OSCP | CRTP

[LaurieWired @lauriewired]

enough people have been hounding me about GhidraMCP that I went ahead and updated it for those interested.

works with latest ghidra, headless + some extra niceties

just directly load plugin + start reversing

[codila @0xCodila]

REA is most dangerous thing on the internet right now...

It lets your AI agent reverse engineer any app, down to the binary

If you use it correctly, you can rebuild any feature you pay for, for FREE

In this article, I show you how: https://t.co/3P1FNXiXzl

[Chizi @chiziaruhoma]

Introducing Eleven: reverse engineering with your agent.

i've always wanted to open any app and just ask what a function does, instead of staring at assembly for hours. so i built it

with Eleven you can:
→ open Mac apps, Android APKs, Windows and Linux binaries, and read every function as pseudocode, assembly, a graph or hex

→ ask Claude, Codex, Gemini, Cursor or any ACP agent about the code. it reads the binary with you and you watch every step

→ your agent renames functions and leaves notes as suggestions. you accept or skip, and everything can be undone

→ patch bytes safely (always a copy, never the original), compare two builds, and debug with lldb

free and open source

[Brute @BRuteLogic]

1-Liner Parser Confusion Bypass

for b in %3B %23 %3F %00; do for e in .json .js .html; do curl -si "https://API-TARGET/v1/users/1$b$e" | head -1 | grep -q 200 && echo "HIT: $b$e"; done; done

%3B still lands in 2026 (CVE-2026-50559).

[Panos Gkatziroulis 🦄 @ipurple]

Bypassing AMSI & ETW: Building a Custom PowerShell Runspace in C# https://t.co/TCjch3ueng

[💾 Izzy Nobre🐁 @izzynobre]

alguem por favor me explica COMO DIABOS dá pra jogar GTA5 no navegador

https://t.co/2jeRSgYAGy

COMO isso é possivel porra? COMO????

[danielhe4rt.php @danielhe4rt]

Pô mano isso aqui tá começando a ficar insano já.

Assim que sair o suporte pra M3/M4 eu vou chutar meu Ryzen imediatamente e migrar pro MacBook Pro.

[Swissky @pentest_swissky]

CVE-2026-87902: WordPress Core unauthenticated path traversal in get page template page-template resolution leading to conditional RCE
https://t.co/B9cmtReMMP

[Panos Gkatziroulis 🦄 @ipurple]

Malware-as-a-Service (MAAS) cyber range for Ludus. Automated offensive development pipeline with CI/CD-driven payload compilation, obfuscation, and EDR evasion testing. https://t.co/b8Bvj7BUTW

[Panos Gkatziroulis 🦄 @ipurple]

Not sure how I managed to miss this repository!

Offensive techniques using Windows Fibers:

1⃣ PoisonFiber (The first remote enumeration & Fiber injection capability POC tool)
2⃣ PhantomThread (An evolved callstack-masking implementation)

https://t.co/jybbehPzIp

[Swissky @pentest_swissky]

Active Directory Attack Architecture Map v2.0
https://t.co/e7ldgRVBRJ

[Panos Gkatziroulis 🦄 @ipurple]

Index of all known BOFs https://t.co/cZHmDkkYbH #redteam

[R.B.C. @G3tSyst3m]

Hey Everyone, here's my latest blog post - Creating a Function Stomping BOF for Adaptix C2! I love using Adaptix C2, and function stomping isn't discussed that much these days, so I thought I'd try and bring both back into the spotlight😺

https://t.co/2iKndOPyZ6

[Quentin Texier 🦀 @g0h4n_0]

Did you know you can request a certificate via NTLM relay through these 2 AD CS endpoints? 🔥

/<CAName>_CES_Kerberos/service.svc/CES
/<CAName>_CES_NTLM/service.svc/CES

This article explains it really well 👇
https://t.co/0z5t2eoY8A

RustHound-CE v2.5.21 now also checks whether these endpoints exist (on top of /certsrv/certfnsh.asp) so #BloodHound can graph the path!

#ADCS #ESC_CES

[Smukx.E @5mukx]

A Position-Independent Code (PIC) agent for Mythic, built on the Stardust shellcode framework.

Starburst compiles shellcode that runs from memory with no PE on disk. Uses FNV1a hash-based API resolution, AES256-CBC encrypted comms, and a compact binary TLV wire protocol.

Github:- https://t.co/qRXNFk2czH

[Smukx.E @5mukx]

UnifiedThreatHunting is a practical framework for building structured threat hunts instead of just running random SIEM queries.

It covers hypothesis driven hunting, telemetry validation, feasibility checks, MITRE ATT&CK mapping, hunt execution, detection handoff, documentation, and automation/AI.

Github:- https://t.co/rLAqigpA0c

[Two Seven One Three @TwoSevenOneT]

🥷 Now we can inject a payload into a remote process without using VirtualAllocEx and WriteProcessMemory.

No need to suspend the target process

New technique to evade EDRs:
Github: TwoSevenOneT/InjectSetConsole

#redteam #pentest #antimalware

[Two Seven One Three @TwoSevenOneT]

InjectSetConsole performs process code injection by leveraging a Windows named pipe.

Unlike traditional techniques, it does not use the VirtualAllocEx and WriteProcessMemory APIs.

#securityblog #cybersecurity
https://t.co/jqXRFfTcuP

[sy.br1d @rafabd1_]

Esse exploit está correto pra CVE-2026-94545, também adicionei ele ao repo https://t.co/3Tk4B6amtx junto com o PoC da CVE-2026-96889 que é falha raiz por trás deste RCE (que ainda afeta dezenas de produtos e curiosamente quase ninguém falou sobre mas ok)

Mas vale destacar tbm que o exploit do RCE é muito dependente do layout da stack usada para executar o librsvg, não é universal e tbm ainda não temos um bypass de ASLR. Por isso o ideal é usar o exploit do UAF para validação inicial

[Cos(余弦)😶‍🌫️ @evilcos]

一个残酷事实：我跟进跟踪了几小时，Chainflip 桥确实在很努力阻拦朝鲜黑客洗币，可惜的是 AML/KYT 落后黑客洗币速度。洗币团伙自动化大量打散资金，通过各类桥跨到不同链，如果被风控或者阻拦退回就会立即尝试下一条洗币路径，最终都将换成 BTC，然后在 BTC 上 CoinJoin 方式接着混淆洗币。

这是一个不断在演变的洗币工程。